Question

I’m creating a method that I will use to hash password to store in a database. I would like to seek advice if my methods in hashing is sufficient or overkill for the task.

    Dim result As Byte()
    Dim mixer As String

    Try
        Dim sha As New SHA512CryptoServiceProvider

        mixer = txt_salt.Text.ToUpper + txt_pass.Text.Trim
        result = sha.ComputeHash(System.Text.Encoding.ASCII.GetBytes(mixer))

        txt_sha.Text = Convert.ToBase64String(result)
    Catch ex As Exception
        MsgBox(ex.ToString)
    End Try

Thanks.

Answer 1

It is insufficient.

1. No salt:
   • vulnerable to rainbow tables (if hashes are leaked)
   • solution: use random salt in large domain
2. Hashes are too fast:
   • vulnerable to brute-force (if hashes are leaked)
   • most hashing algorithms are designed to be fast
   • solution: bcrypt, scrypt or multiple (many!!!) rounds
3. No HMAC:
   • does not have additional “server secret” (stored outside db!)
   • solution: hmac-sha1, etc.
4. Not part of a well-tested library/framework for authentication:
   • this is a “roll your own” implementation
   • solution: don’t reinvent a wheel, unless it’s one of these or these 🙂

As far as “bits” go, SHA1 is perfectly fine with 160 (but it is not fine [by itself] for other reasons). Doing both SHA256+SH512 just complicates the matter for zero gain. (Actually, it is a very slight net loss due to the extra storage requirements.)

I suggest using an existing library/system, unless this is an academic project 🙂

Happy coding.